tech-lead-skill 5.4.10 → 5.5.1

package/README.md

@@ -56,7 +56,7 @@ Ships on the DSH plugin market (npm) as ONE self-contained package, **`dsh-themi
 dsh plugin --profile headless add dsh-themis
 ```
 
-21 read-only lifecycle tools in a single artifact (the original nine audits plus context validation, evidence graph/freshness analysis, progress decisions, critical-path/impact analysis, resume reconciliation, gate planning/aggregation/reopen checks, and mutation preview). Tools compute over caller-supplied JSON only — no filesystem writes, no subprocesses, no network access. The earlier split packages (`dsh-tech-lead-{core,plugin,bundle}`) are deprecated in favor of this one. Source checkouts remain supported: build via `node scripts/build-market-package.mjs` then `dsh plugin add packages/dsh-themis`. The root npm package distributes the skill and installer only.
+22 registered entry points in a single artifact: 21 read-only governance tools plus a capability-discovery tool (`tech_lead_capabilities`) that lists only what this bundle actually registers (the original nine audits plus context validation, evidence graph/freshness analysis, progress decisions, critical-path/impact analysis, resume reconciliation, gate planning/aggregation/reopen checks, and mutation preview). Tools compute over caller-supplied JSON only — no filesystem writes, no subprocesses, no network access. The earlier split packages (`dsh-tech-lead-{core,plugin,bundle}`) are deprecated in favor of this one. Source checkouts remain supported: build via `node scripts/build-market-package.mjs` then `dsh plugin add packages/dsh-themis`. The root npm package distributes the skill and installer only.
 
 ```bash
 dsh plugin --profile headless add /path/to/tech-lead-skill/packages/dsh-themis
@@ -81,6 +81,17 @@ Copy `skill/SKILL.md` and the `skill/templates/` directory into the skills direc
 
 The skill is triggered by project construction, system building, implementation plans, deployment, migration, release, recovery, restructuring, operations work, and other substantial planning requests. It can also be loaded explicitly.
 
+## Lifecycle results are valid analyses
+
+`PAUSE`, `PIVOT`, `SCOPE-DOWN` and `STOP` from `tech_lead_progress_decide` are returned as **ok:true** analyses with `data.outcome`; a not-yet-passed gate returns `ok:true` with `data.verdict`/`data.pass`. `ok:false` is reserved for malformed input, over-budget payloads (`INPUT_TOO_LARGE`, `ITEM_LIMIT_EXCEEDED`) and incomplete safety scans (`SCAN_INCOMPLETE`). Decision tools attach a deterministic `data.guidance.nextActions[]`; every action carries reason codes, a finding reference and a `doneWhen` predicate. Heuristic suggestions appear only under explicit `guidanceMode:"heuristic"`.
+
+## Four-tool starter loop
+
+1. `tech_lead_classify` — copy the returned tier into your snapshot's `current.tier`.
+2. `tech_lead_context_validate` — validate the full inline snapshot (schema `tech-lead.context.v1`; canonical example: tests/fixtures/starter-context.v1.json).
+3. `tech_lead_evidence_lint` — pass the snapshot's `evidence` array as a JSON string; findings are advisory.
+4. `tech_lead_progress_decide` — feed the same snapshot; read `data.outcome`, then follow `data.guidance`.
+
 ## Operating Modes
 
 ### PLAN
@@ -137,6 +148,6 @@ The executable skill body (`SKILL.md`) is authored in Simplified Chinese; coding
 
 ## Version
 
-Current version: `v5.4.6`.
+Current version: `v5.5.1`.
 
 See [`docs/TECHNICAL_GUIDE.md`](docs/TECHNICAL_GUIDE.md) for the full operating model and [`docs/AUDIT_REPORT.md`](docs/AUDIT_REPORT.md) for the publication audit.

package/README.zh-CN.md

@@ -56,7 +56,7 @@ npx github:240xu/tech-lead-skill
 dsh plugin --profile headless add dsh-themis
 ```
 
-单包内含全部 21 个只读生命周期工具：原九项审计＋上下文校验、证据图/新鲜度分析、推进决策、关键路径/影响分析、续跑对账、Gate 计划/聚合/重开、变更预览。仅对调用方传入的 JSON 做计算——无文件写入、无子进程、无网络访问。旧拆分包（`dsh-tech-lead-{core,plugin,bundle}`）已弃用并指向本包。源码安装：`node scripts/build-market-package.mjs` 装配后 `dsh plugin add packages/dsh-themis`。根 npm 包只发布技能与安装器。
+单包注册 22 个入口：21 个只读治理工具（原九项审计＋上下文校验、证据图/新鲜度分析、推进决策、关键路径/影响分析、续跑对账、Gate 计划/聚合/重开、变更预览）＋能力发现工具 `tech_lead_capabilities`（只列出本包实际注册的工具）。仅对调用方传入的 JSON 做计算——无文件写入、无子进程、无网络访问。旧拆分包（`dsh-tech-lead-{core,plugin,bundle}`）已弃用并指向本包。源码安装：`node scripts/build-market-package.mjs` 装配后 `dsh plugin add packages/dsh-themis`。根 npm 包只发布技能与安装器。
 
 ```bash
 dsh plugin --profile headless add /path/to/tech-lead-skill/packages/dsh-themis
@@ -81,6 +81,17 @@ dsh --profile headless --dump-config   # 确认 tech-lead-tools 行已注入
 
 该技能由"构建项目/搭系统/制定执行计划/部署/迁移/发布/恢复/重构/运维"等实质性任务触发，即使用户没有明确说“项目”或“Tech Lead”也应加载；也可以显式加载。
 
+## 生命周期结果是有效分析
+
+`tech_lead_progress_decide` 的 `PAUSE`/`PIVOT`/`SCOPE-DOWN`/`STOP` 以 **ok:true** 分析返回（`data.outcome`）；未通过的 Gate 同样 ok:true（`data.verdict`/`data.pass`）。`ok:false` 只用于非法输入、超预算载荷（`INPUT_TOO_LARGE`、`ITEM_LIMIT_EXCEEDED`）与不完整安全扫描（`SCAN_INCOMPLETE`）。决策类工具附带确定性的 `data.guidance.nextActions[]`：每条动作含原因码、finding 引用与 `doneWhen` 完成谓词。启发式建议仅在显式 `guidanceMode:"heuristic"` 下出现。
+
+## 四工具起步环
+
+1. `tech_lead_classify` —— 把返回的 tier 写入快照 `current.tier`。
+2. `tech_lead_context_validate` —— 校验完整内联快照（schema `tech-lead.context.v1`；范例 tests/fixtures/starter-context.v1.json）。
+3. `tech_lead_evidence_lint` —— 把快照的 `evidence` 数组序列化为字符串传入；findings 仅作建议。
+4. `tech_lead_progress_decide` —— 喂入同一快照；读 `data.outcome` 后按 `data.guidance` 行动。
+
 ## 工作模式
 
 ### PLAN
@@ -137,6 +148,6 @@ dsh --profile headless --dump-config   # 确认 tech-lead-tools 行已注入
 
 ## 版本
 
-当前版本：`v5.4.5`.
+当前版本：`v5.5.1`.
 
 完整运行模型见[技术指南](./docs/TECHNICAL_GUIDE.zh-CN.md)，发布审计见 [docs/AUDIT_REPORT.md](docs/AUDIT_REPORT.md)。

package/docs/AUDIT_REPORT.md

@@ -35,7 +35,7 @@ The source set was scanned for local absolute paths, passwords, API-key prefixes
 ### Structural scan
 
 - YAML frontmatter has `name: tech-lead` and a trigger description.
-- The skill version is `v5.4.10`.
+- The skill version is `v5.5.1`.
 - The eight templates referenced by the skill exist.
 - The installer validates options, requires a marker before removing any target, and records the managed package/version after installation.
 - The release-check template covers allowlist inventory, sensitive-content scanning, reference checks, scope checks, publication results, and remote verification.
@@ -48,7 +48,7 @@ The skill defaults user data to read-only, requires a recovery path before write
 
 ## Known Limitations
 
-- Core judgment stays prose-first; the source-checkout-only DSH workspace provides 21 machine-checkable read-only tools for context, evidence, progress, gates, release/install audits, recovery, and mutation preview. The root npm tarball intentionally excludes the private workspace packages. The original nine tools keep their pre-envelope response shapes for backward compatibility; the twelve strengthened tools return ResultEnvelope v1 (documented in docs/superpowers/specs/2026-08-25-dsh-tech-lead-system.md §4.2).
+- Core judgment stays prose-first; the source-checkout-only DSH workspace registers 22 machine-checkable entry points (21 governance tools + `tech_lead_capabilities` discovery) for context, evidence, progress, gates, release/install audits, recovery, and mutation preview. The root npm tarball intentionally excludes the private workspace packages. Since R6, legacy tools keep bare shapes except `tech_lead_gate_precheck` (envelope projection preserving `data.pass`/`data.violations`); strengthened tools return ResultEnvelope v1 where every governance-negative state is a valid `ok:true` analysis with closure guidance. Legacy audit arrays over the 500-finding window fail closed with `SCAN_INCOMPLETE` instead of being silently sliced (spec: docs/superpowers/specs/2026-08-26-dsh-themis-guidance-architecture.md).
 - Freshness, reconciliation, and rollback verification depend on the executing environment.
 - No claim is made that the skill has completed a multi-project effectiveness trial; that is the next validation phase.
 - The audit validates publication content, not the security of the hosting platform or every consumer's local OpenCode installation.

package/docs/TECHNICAL_GUIDE.md

@@ -131,3 +131,7 @@ The bundled templates are records, not decorative checklists:
 - `release-check.md` records the seven release phases and stops publication when a prerequisite or remote verification is unresolved.
 
 Use the smallest applicable artifact set, but do not omit a required record merely because the work is inconvenient to document. A template entry without an evidence anchor is an open item, not proof of completion.
+
+## Lifecycle results (R6)
+
+PAUSE/PIVOT/SCOPE-DOWN/STOP and gate non-pass states are valid `ok:true` analyses; `ok:false` is reserved for malformed input, budget overruns and incomplete scans (`SCAN_INCOMPLETE`). Guidance actions always carry `doneWhen` predicates.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tech-lead-skill",
-  "version": "5.4.10",
+  "version": "5.5.1",
   "description": "Evidence-driven planning and safe change-control skill for OpenCode-compatible agents",
   "license": "MIT",
   "repository": {

package/skill/SKILL.md

@@ -3,7 +3,7 @@ name: tech-lead
 description: 用于软件、基础设施、研究和运维中的多步、跨边界或有状态工程交付：项目规划、架构选择、跨模块实现、部署、迁移、发布、恢复、重构、长期运行与跨会话续跑。涉及不可逆/生产变更、回滚验证、真实环境对账、发布安全或项目级交付治理时优先加载，即使用户没有说“项目”或“Tech Lead”。不要仅因一次性小修复、单文件编辑、普通解释、单次测试或只读代码审查而自动加载，除非用户明确要求项目级计划或本规范。
 ---
 
-# Tech Lead · 自主演进规划与交付规范 v5.4.10
+# Tech Lead · 自主演进规划与交付规范 v5.5.1
 
 > 双层架构声明：本文件是**判断层**（自由裁量域）。其中可机械判定的不变量（Gate 前置校验、
 > 证据锚点存在性、分级判定器、状态机转换有效性）为未来 **MCP 工具化候选**——